The cloud has been around since the 1960’s but the credit for inventing the modern concept of cloud computing goes to Google’s 2006 CEO, Eric Schmidt. Over the years many misconceptions about the cloud have arisen, and you can find a shocking number of articles on the subject. While this is a cloud misconception article, we are going to focus on the compliance aspect of the cloud.
Myth 1: Regulators hate the cloud – especially HIPAA
This is the leading myth when it comes to the cloud being utilized by covered entities and business associates. The Department of Health and Human Service (HHS) released Guidance on HIPAA &Cloud Computing, which covers questions on storing and processing ePHI within the cloud.
“A covered entity (or business associate) that engages a CSP should understand the cloud computing environment or solution offered by a particular CSP so that the covered entity (or business associate) can appropriately conduct its own risk analysis and establish risk management policies, as well as enter into appropriate BAAs. In addition, a Service Level Agreement (SLA)[4] is commonly used to address more specific business expectations between the CSP and its customer, which also may be relevant to HIPAA compliance.” (The Department of Health and Human Service)
Myth 2: Compliance within the cloud requires nothing from you
In the Cloud Computing Guidelines issued by the PCI Security Standards Council, the PCI states that “[c]lear policies and procedures should be agreed between client and cloud provider for all security requirements, and responsibilities for operation, management and reporting should be clearly defined and understood for each requirement.” This is a very similar concept to the guidelines set forth under HHS for a business associate agreement (BAA). If you outsource your CSP, make sure your SLA covers what they will handle and what is left as your responsibility.
Myth 3: Virtualization is never compliant
This myth should be reworded but this is the common misconception. The cloud by default is made up of virtual machines that run on numerous physical machines. There are specific areas that will need your attention highlighted in the PCI DSS Virtualization Guidelines. One of the main areas needing special attention is the hypervisor, which has an attack surface unique to virtualization. You should also monitor mixing different trust levels within your virtual environment.
Myth 4: Compliance is easy, anyone can do it
This last myth is truly baffling. If compliance was so easy, why isn’t everyone compliant? The simple fact is, compliance is complex and should be handled by a certified professional. It is critical that organizations have crucial safeguards in place, for not only the cloud but all other aspects of the organization. This is not just a healthcare concern, because all industries have compliance guidelines in place to help keep their organizations as well as their customers safe.
For more information on cloud computing and compliance, to speak to our Advisory Services Division call +1 (866) 216-4366 or email This email address is being protected from spambots. You need JavaScript enabled to view it..
Articles You Might Find Interesting:
The Blame Game After a Data Breach
ERP Fine Print - Do You Know What You're Deploying?
Your July 2018 Cybersecurity Report - Video
Share this article: